Archive
17 December 2021
Vulnerabilities first published on this day (UTC), newest first.
66 results · Feed
-
High 7.5
Incorrect Comparison in cvxopt
Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake …
-
High 8.1
Using JMSAppender in log4j configuration may lead to deserialization of untrusted data
### Impact ClickHouse JDBC Bridge uses [slf4j-log4j12 1.7.32](https://repo1.maven.org/maven2/org/slf4j/slf4j-log4j12/1.7.32/), which depends on [log4j 1.2.17](https://repo1.maven.org/maven2/log4j/log4j/1.2.17/). It allows a remote attacker to execute code on …
-
High 7.5
Classic Buffer Overflow in pyo
Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo < 1.03 in the Server_debug function, which allows remote attackers to conduct DoS attacks by deliberately passing on an overlong audio file name.
-
High 7.5
Pyo Buffer Overflow Vulnerability
Buffer overflow in ajaxsoundstudio.com Pyo < and 1.03 in the Server_jack_init function. which allows attackers to conduct Denial of Service attacks by arbitrary constructing a overlong server name.
-
High 7.5
bounter Null pointer reference
Null pointer reference in CMS_Conservative_increment_obj in RaRe-Technologies bounter version 1.01 and 1.10, allows attackers to conduct Denial of Service attacks by inputting a huge width of hash bucket.
-
Critical 9.8
Access Control Bypass
This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after th…
-
High 7.5CVE-2021-23450 EPSS 30%
Prototype Pollution
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
-
High 7.5CVE-2021-23797 Public exploit
Directory Traversal
All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is.
-
Medium 6.7
Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager
This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: 1. Install a package with a web Larave…
-
Medium 5.5
Buffer Copy without Checking Size of Input in NumPy
Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability…
-
High 7.5
NumPy NULL Pointer Dereference
Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct …
-
Medium 5.3
Incorrect Comparison in NumPy
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless…
-
Medium 5.3
NumPy Buffer Overflow (Disputed)
A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does …
-
Medium 5.3
Regular Expression Denial of Service (ReDoS) in jsx-slack
jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into `<blockquote>` tag…
-
Medium 4.4
Path traversal in message_bus
message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled (default off) are vulnerable to a path traversal bug, which could lead to disclosure of secret infor…
-
Medium 5.4
IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable …
-
Unscored —
The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the pas…
-
Unscored —
A vulnerability in /include/web_check.php of SEMCMS v3.8 allows attackers to reset the Administrator account's password.
-
Unscored —
A buffer overflow vulnerability in the Virtual Path Mapping component of FTPShell v6.83 allows attackers to cause a den…
-
High 7.1
Parallels Remote Application Server credentials management errors
Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by Parallels RAS. The confidentiality, availability and integrity of the information of …
-
High 7.2
TCMAN GIM missing authorization vulnerability
TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL that require privileges without having them. The exploitation of this vulnerability might allow a re…
-
Medium 6.1
TCMAN GIM open redirect vulnerability
TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote attacker to obtain information.
-
High 7.5
TCMAN GIM SQL injection vulnerability
TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information.
-
Critical 10.0
TCMAN GIM SQL injection vulnerability
TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx.
-
Low 3.5
Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated a…
-
Low 3.7
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers…
-
Unscored —
Integer Underflow vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT…
-
Unscored —
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and …
-
Unscored —
Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOF…
-
High 7.5
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and…
KEV Mar 9, 2026 -
Unscored —
In alac decoder, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local info…
-
Unscored —
In Audio Aurisys HAL, there is a possible permission bypass due to a missing permission check. This could lead to local…
-
Unscored —
In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o…
-
Unscored —
In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local informatio…
-
Unscored —
In apusys, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of …
-
Unscored —
In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privil…
-
Unscored —
In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local informatio…
-
Unscored —
In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privil…
-
Unscored —
In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o…
-
Unscored —
In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o…